The opinion in support of the decision being entered today was not written for 
publication and is not binding precedent of the Board. 
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DECISION ON APPEAL 
This is a decision on appeal under 35 U.S.C. § 134 from the examiner's final 
rejection of claims 1-29, which are all the claims in the application. 
We affirm. 
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BACKGROUND 

The invention relates to a method of defining security conditions of a computer 

system. Representative claim 1 is reproduced below. 

1 . A method of defining the security condition of a computer system, 
comprising: 

generating a human-readable and machine-readable vulnerability 
description language (VDL) file specifying: 

an identity of an attack; 

at least one attribute of the specified attack; 

at least one policy definition with respect to the specified attack; 
and 

at least one attribute of the specified policy definition. 

The examiner relies on the following references: 

Vaidya US 6,279,113 B1 Aug. 21, 2001 

(filed Jun. 4, 1998) 

Chefalas et al. (Chefalas) US 2002/01 16639 A1 Aug. 22, 2002 

(filed Feb. 21,2001) 

Claims 1 and 3-29 stand rejected under 35 U.S.C. § 102 as being anticipated by 

Chefalas. 

Claim 2 stands rejected under 35 U.S.C. § 103 as being unpatentable over 
Chefalas and Vaidya. 
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We refer to the Final Rejection (mailed Aug. 31, 2005) and the Examiner's 
Answer (mailed Jun. 8, 2006) 1 for a statement of the examiner's position and to the 
Brief (filed Dec. 27, 2005) and the Reply Brief (filed Mar. 10, 2006) for appellants' 
position with respect to the claims which stand rejected. 

OPINION 

In accordance with appellants' arguments in the Brief, we will decide the appeal 
on the basis of the Chefalas reference as applied against the independent claims 1,12, 
and 17. See 37 CFR § 41 .37(c)(1)(vii). 

Chefalas describes a method and system for defining the security condition of a 
computer system. Information regarding virus attacks and actions includes data 
packets passing from clients to servers and from servers to clients (Figs. 4A, 4B; fflj 44- 
45) and security policies (Figs. 5A and 5B; U 46). The examiner finds that Chefalas 
describes generating a vulnerability description language (VDL) file within the 
requirements of instant claim 1 . 

Appellants submit that the files depicted in the drawings are not "human- 
readable and machine-readable" as recited in the claims. However, the data is clearly 
machine-readable, as the computers are responsive to the information in the files (e.g., 
H 28). We have considered appellants' arguments to the contrary, but in our estimation 



1 The examiner mailed this corrected version of the Answer after appellants' filing of the briefs. 
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the reference also supports the examiner's finding that the files are "human-readable." 
The information depicted in Figures 4A through 5B is presented as English text (e.g., 
text in payload 404 of Fig. 4A; policy represented in Fig. 5A). Further, the information 
may be collected and presented to a human viewer (e.g., U 30), which indicates that the 
files are stored in human-readable form. Moreover, the various policies with respect to 
particular viruses are not machine-generated, but human-generated. One can 
reasonably assume that the policies are not converted to some form that is readable 
only by a machine, at least for the reason that human-readable files would facilitate 
updating of the policies provided by remote administrator 138 (Fig. 1), which may reside 
in a relational database (H 48). 

Appellants also allege that even if the reference may be considered to describe a 
file both human and machine-readable, the information shown does not meet the 
language specifying the contents of the file as recited in claims 1 and 12. However, 
appellants in the Brief consider only the policies shown in Figures 5A and 5B of 
Chefalas, rather than all the data that the examiner finds to comprise the VDL file as 
claimed. Further, in response to the examiner's additional findings in the Answer, 
appellants return to the argument that the data is not "human-readable and machine- 
readable." Appellants thus do not persuade us of error in the rejection of claims 1 and 
12. 

Moreover, we observe that claim 1 and claim 12 are drawn to respective 
methods of generating a file. Appellants' arguments regarding the content of the files 

-4- 



Appeal No. 2006-2509 
Application No. 10/001,431 

are not persuasive because the content of the files is in the form of what has come to 
be known as nonfunctional descriptive material. Appellants are not claiming any type of 
computer program (which may be considered as functional descriptive material) or any 
type of machine response to the material contained in the files. The claims are drawn 
to the generation of mere arrangements of data, which are not, incidentally, limited to 
be on any particular physical medium (e.g., computer-readable media). In short, 
appellants are claiming "a process that differs from the prior art only with respect to 
nonfunctional descriptive material that cannot alter how the process steps are to be 
performed to achieve the utility of the invention." Manual of Patent Examining 
Procedure (MPEP) § 2106, page 2100-22 (8th Ed., Rev. 3, Aug. 2005). 

We find that claim 1 , for example, is anticipated by a description of generating a 
file having four items of information, for which Chefalas suffices. The content of the 
nonfunctional descriptive material carries no weight in the analysis of patentability over 
the prior art. Cf. In re Lowrv . 32 F.3d 1579, 1583, 32 USPQ2d 1031, 1034 (Fed. Cir. 
1 994) ("Lowry does not claim merely the information content of a memory. . . . [N]or 
does he seek to patent the content of information resident in a database."). 

Instant claim 17 is drawn to a system comprising a VDL file containing two items, 
an interpreter to parse and organize the items, and a data storage to store the parsed 
and organized items that is accessible by at least one security application. 

The examiner finds that the elements and the claimed details are found in 
Chefalas, with particular emphasis on paragraph 48 of the reference, disclosing that the 
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tables illustrating policies (Figs. 5A and 5B) may be implemented in a relational 
database. 

Appellants describe an interpreter 202 (Fig. 3) that reads VDL file 200, parses 
the descriptions, and organizes them into tables in a configuration database 204. 
(Spec, at 8-9.) With respect to the database described by Chefalas, information 
generated by human beings may be entered into a relational database by a machine 
reading a file prepared by a human being, or by a human being entering data at a 
terminal. Instant claim 17 is sufficiently broad to read on either method; e.g., a human 
being reading a file and entering the information into a data terminal, with the database 
program parsing the information and organizing the information pursuant to the 
predetermined format of the database design. The artisan would appreciate that 
Chefalas describes a system within the scope of claim 17, even without the reference 
expressing the details of how information gets from human beings into a relational 
database. "A reference anticipates a claim if it discloses the claimed invention 'such 
that a skilled artisan could take its teachings in combination with his own knowledge of 
the particular art and be in possession of the invention .'" In re Graves . 69 F.3d 1 147, 
1152, 36 USPQ2d 1697, 1701 (Fed. Cir. 1995) (quoting In re LeGrice . 301 F.2d 929, 
936, 133 USPQ 365, 372 (CCPA 1962)). 
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We have considered all of appellants' arguments in response to the rejection of 
claim 17, but in our view the reference supports the examiner's finding of anticipation. 2 
We thus sustain the examiner's rejections. 

CONCLUSION 

The rejection of claims 1 and 3-29 under 35 U.S.C. § 102 and the rejection of 
claim 2 under 35 U.S.C. § 103 are affirmed. 



2 Moreover, claim 17 is drawn to, at best, a file containing nonfunctional descriptive material and 
"a computer that differs from the prior art solely with respect to nonfunctional descriptive material that 
cannot alter how the machine functions (i.e., the descriptive material does not reconfigure the computer). . 
. ." MPEP§2106, p. 2100-22. 
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No time period for taking any subsequent action in connection with this appeal 
may be extended under 37 CFR § 1.136(a). See 37 CFR § 1.136(a)(1)(iv). 



AEFIRMED 
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